Experimental quantum cryptography scheme based on orthogonal states 
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Since, in general, non-orthogonal states cannot be cloned, any eavesdropping attempt in a Quan- 
tum Communication scheme using non-orthogonal states as carriers of information introduces some 
errors in the transmission, leading to the possibility of detecting the spy. Usually, orthogonal states 
are not used in Quantum Cryptography schemes since they can be faithfully cloned without altering 
the transmitted data. Nevertheless, L. Goldberg and L. Vaidman [Phys. Rev. Lett. 75 (1995) 1239] 
proposed a protocol in which, even if the data exchange is realized using two orthogonal states, 
any attempt to eavesdrop is detectable by the legal users. In this scheme the orthogonal states are 
superpositions of two localized wave packets travelling along separate channels. Here we present an 
experiment realizing this scheme. 

PACS numbers: 03.67.Hk, 03.67.Dd, 42.50.Ex, 42.50.St 
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Quantum Key Distribution (QKD) is a method for 
transmitting a secret key between two partners (usually 
named Alice and Bob) by exploiting quantum properties 
of light. The most important characteristic of this idea 
is that the secrecy of the generated key is guaranteed by 
the very laws of nature, i.e. by the properties of quan- 
tum states pn. In the last decade QKD has abandoned 
the laboratories becoming a mature technology for com- 
mercialization [2 ; communications over more thane 100 
km having been achieved both in fiber [3j and open air 

Various protocols for realising QKD have been sug- 
gested [1], such as BB84 [5 , B92 [6 , Ekert [7]. Ah of 
them are based on the use of non-orthogonal states, a 
condition that was considered necessary for guaranteeing 
security, up to a paper of Goldenberg and Vaidman (GV) 
[8] . In that work was presented for the first time a scheme 
for realising a QKD protocol based on orthogonal states, 
whose security was based on two ingredients. First, the 
orthogonal states sent by Alice were superposition of two 
localised wave packets that were not sent simultaneously 
to Bob. Second, the transmission time of the photons 
was random. 

This scheme, beyond its interest for application, has 
also a large conceptual interest for understanding the 
quantum resources/properties needed for QKD. Never- 
theless, up to now, no experimental realization was still 
done. Purpose of this letter is to present its first experi- 
mental implementation. 

In the theoretical proposal of Ref.[8 , the orthogonal 
states sent by Alice are the superpositions of two local- 
ized wave-packets. Those are not sent simultaneously to 
Bob, but separated by a fixed delay. In this case there 
is a direct correspondence between the state prepared by 
Alice and the bit received by Bob, for instance, 

^|*o> =^(|a> + |&» 

1 ^|*i) =-L(|a)-|6)), 



where \a) and \h) are two localized wave-packets and the 
states l^o) and |^i) are orthogonal. The states |^o) and 
l^i) are emitted randomly in time, and the presence of 
an eventual eavesdropper can be detected by legitimate 
users exploiting the information on the detection times 
[8 . The scheme works as follows: Alice sends Bob ei- 
ther l^o) or l^i). The launch on the quantum channel 
of the wave-packet \h) is delayed for some amount of time 
r with respect to the launch of wave-packet \a). r could 
be chosen larger than the traveling time T of photons 
between Alice's and Bob's locations. As \b) will travel 
through the quantum channel only after the wave-packet 
I a) has already reached Bob's location, both packets are 
never simultaneously present in the quantum channels. 
Furthermore, as pointed out in Ref. [8 , the requirement 
of r greater than the traveling time T is not strictly nec- 
essary. Indeed the security of the protocol is ensured 
even if r is only greater than the overall uncertainty in 
the measurement of the transmission/detection times ts 
and tr [8]. 

In our proof-of-principle experiment this is obtained 
exploiting a balanced Mach-Zehnder Interferometer 
(MZI) with two equal optical delays ODi and 01^2- Ac- 
cording to Fig. 1, sources of single photon ^o and Si 
at the two input ports of the beam splitter on Alice side 
provide single photons propagating in the transmission 
channel in the state |^o) or |^i) respectively. The emis- 
sion time of the single photon in one of the two state is 
random, but it is registered by Alice. 

As the packet \h) is stored in OZ^i, wave-packet \a) 
travels from Alice's to Bob's site along the upper chan- 
nel and enters in 01^2, where it is delayed until also \h) 
reaches Bob's site. In this way the two packets interfere 
as they simultaneously arrive to the second beam-splitter, 
thus, the click of detector Di deterministically implies 
that the single photon state was in the state |^i), i.e. it 
was sent by source S^. Two security tests are performed 
by Alice and Bob to highlight the possible presence of 
an eavesdropper. The first one is a public comparison 
between the sending times tg and the receiving times tr 




FIG. 1: Experimental set-up. Two single photon sources 
(5'o,*S'i, realized exploiting an heralded single photon source 
based on parametric down-conversion (PDC) obtained by 
pumping with a 406 nm CW laser beam a type I BBO crystal) 
are injected in the MZI, one at the time. Alice's site is com- 
posed by the two single photon sources and the first optical 
delay (ODi). Bob's site is composed by the second optical 
delay (OD2, identical to ODi) and the two single photon de- 
tectors (Do, Di). 



for each photon. If we assume that the traveling time 
between the two parties is T, only the events detected at 
time tr = ts-\-r-\-T are considered as part of the message, 
while all the others highlight the presence of Eve. The 
second one is the comparison of corresponding portions of 
the legitimate users' bit strings to estimate the quantum 
bit error rate (QBER). We underline that in the ideal 
case discrepancies in the transmission/detection times or 
in the bit strings can only be induced by an eavesdropper. 

Let us mention for the sake of completeness that it was 
argued by Peres ^ that this protocol introduced no nov- 
elty with respect to BB84. To this claim GV replied that 
while in other protocols like BB84 the security is guaran- 
teed by nonorthogonality, in GV protocol it is based on 
causality, since they proved that a successful eavesdrop- 
ping would require superluminal signaling [8]. Further- 
more, while all cryptographic schemes require two steps 
for sending information (sending the quantum object and 
then some classical information) , in GV protocol only the 
first step is needed for communication, the second step is 
used only for assuring security against eavesdropping. 

Fig.l shows the setup of the experiment representing 
the first realization of the GV protocol. The single pho- 
ton states are obtained exploiting an heralded single pho- 
ton source based on parametric down- conversion (PDC) 
[TT] . A CW 100 mW Coherent Cube diode laser sys- 
tem at 406 nm is used to pump a BBO type I crystal. 
PDC photons pairs at degeneracy (812 nm) are emitted 
in slightly non-collinear regime (three degrees with re- 
spect to the pump direction). The heralding photons are 
selected by means of 1 nm bandwidth interference fil- 
ters, collected in a multimode optical fiber and detected 



by Single Photon Avalanche Photo-diodes (SPAD) de- 
tectors. The heralded single photon, the carrier of the 
information to be exchanged between the legitimate par- 
ties, is collected in a single mode optical fibre (a 10 nm 
interference filter is placed on the heralding arm only 
for background suppression). The CW laser operation 
ensures the generation of photon pairs at random time, 
and the detection of one photon of the pair in the herald- 
ing arm provides the temporal information on the emis- 
sion of the single-photon as requested by the GV pro- 
tocol. With the aim of realizing the proof-of-principle 
QKD scheme proposed by GV, Alice sends bit or 1 
by addressing the encoding photon to the proper input 
port of the first beam-splitter. Bob detect the single pho- 
tons at the output of the interferometer. The balanced 
MZI contains both the optical delays and the transmis- 
sion channel from Alice to Bob. In particular, after the 
input BS at the Alice side one arm of the interferome- 
ter contains a delay line (realized through a trombone 
prism), while on the other arm the delay line (again 
based on a trombone prism) is located on Bob's side. 
The positions of the trombones in the optical delays are 
adjusted via a closed loop piezo- movement system with 
nano-metric resolution. Detection events after the out- 
put BS of the interferometer are obtained by SPAD de- 
tectors operating in Geiger mode. The electronics high- 
lighting the presence of coincident detections is based, 
as usual, on Time-to-Amplitude-Converter and Multi- 
Channel- Analyser. Specifically, in our case the temporal 
condition for the security of the QKD scheme is satis- 
fied as the jitter of our detectors (corresponding to the 
uncertainty in the determination of the of the transmis- 
sion/detection times) is about 300 ps, while the length 
of the delay lines is 60 cm corresponding to a storage 
time of ~2 ns. The stability of the interferometer has 
been tested by scanning the position of Alice's trombone 
prism with Bob's one kept at a fixed position. Fig. 2 
shows the interference fringes of heralded counts and the 
visibilities (V) are well above 80%, irrespective of which 
port of the input beam splitter is used to inject the single 
photon in the interferometer. 

The quality of the transmission is quantified by the 
Quantum Bit Error Rate (QBER = p ^wror^g 

where Pmght {Pwrong) is the probability for Bob to re- 
ceive a bit value which is equal to (different from) the one 
sent by Alice), measured to be 7%, according to Table I. 

In conclusion, we have realized the first proof-of- 
principle experimental implementation of QKD based on 
orthogonal states (GV protocol) [8]. Our results demon- 
strate the possibility of achieving a secure QKD trans- 
mission with orthogonal state and therefore provides a 
significant hint to the discussion on the minimal quantum 
resources necessary for the implementation of quantum 
tasks overcoming classical limits. 

This work has been supported by PRIN 2007FYETBY 
(CCQOTS) and NATO (CBP.NR.NRCL 983251). We 
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FIG. 2: Number of detected events per second at detector Do 
and Di as a function of the path length difference Al between 
the two arms of the interferometer for source 5*0 (top picture) 
and 5*1 (bottom). As expected, the phase shifts between Dq 
and Di sine fits of the coincidence counts are consistent with 
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(89 ±1)% 


(82 ±1)% 


(7.0 ±1.6)% 


SI 


(88 ±1)% 


(85 ±1)% 


(7.1 ±1.4)% 



TABLE I: Main results obtained in the implementation of the 
QKD protocol proposed in Ref. ^. Vdo, Vdi are the visibil- 
ities of the interference fringes observed at the two outputs 
of the interferometer by scanning the path length difference, 
QBER is the estimated quantum bit error rate for the trans- 
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